Information Leakage Detection in Distributed Systems using Software Agent

Covert channel attacks utilize shared resources to indirectly transmit sensitive information to unauthorized parties. Current security mechanisms such as SELinux rely on tagging the filesystem with access control properties. However, such mechanisms do not provide strong protection against information laundering via covert channels. Colored Linux [20], an extension to SELinux, utilizes watermarking algorithms to "color" the contents of each file with their respective security classification to enhance resistance to information laundering attacks. In this paper, we propose a mobile agent-based approach to automate the process of detecting and coloring receptive hosts' filesystems and monitoring the colored filesystem for instances of potential information leakage. Implementation details and execution results are included to illustrate the merits of the proposed approach.

• Type: Journal
• Year: 2009
• Where: IEEEIA
• Authors: Yung-Chuan Lee, Stephen Bishop, Hamed Okhravi, Shahram Rahimi
• Keywords: Covert Channels, Filesystem, IEEEIA 2009, Information Laundering, Intelligent Agents